apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  # Core initialization (runtime classes)
  - init.yaml
  # Namespace definitions with PodSecurity labels
  - namespaces.yaml
  # RBAC for gateway to create sandboxes (creation only)
  - gateway-rbac.yaml
  # RBAC for lifecycle sidecar (self-deletion)
  - lifecycle-sidecar-rbac.yaml
  # Admission policies (image restriction, security requirements)
  - admission-policy.yaml
  # Resource quotas and limits for sandboxes namespace
  - sandbox-quotas.yaml
  # Network isolation policies
  - network-policies.yaml
  # Gateway service
  - gateway.yaml
  - gateway-ingress.yaml
  # Example sandbox deployment (for reference, not applied by default)
  # - sandbox-deployment-example.yaml
  # Services
  - web.yaml
  - ingress.yaml
